Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
择日学技能
v2.0.0择日学技能。支持查询吉日凶日、建除十二神、黄道黑道、神煞吉凶，提供婚嫁、开业、动土、出行等择日建议。
⭐ 0· 105·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's purpose (择日/吉日推荐) is coherent with the included computational logic. It does not request credentials, binaries, or config paths, which is appropriate for its stated functionality. However, the SKILL.md usage examples call a Python script (scripts/ze_ri.py) while the package contains a Node.js file (index.js) — a mismatch that undermines confidence in the package.
Instruction Scope
SKILL.md instructs running python3 scripts/ze_ri.py and python CLI examples; no such Python script or scripts/ directory is present. The provided SKILL.md does not direct reading unrelated system files or env vars, but the mismatch may cause an agent to try running missing commands or searching the filesystem, which is unexpected behavior.
Install Mechanism
No install specification is provided (instruction-only with a code file). This is low risk from an installation perspective — nothing is downloaded or written by an installer.
Credentials
The skill declares no required environment variables or credentials and the code does not access env vars or network resources. The requested privileges are proportionate to its purpose.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and uses default invocation settings. There is no unusual persistence or privilege requested.
What to consider before installing
Do not install or enable this skill until the author clarifies and fixes the inconsistencies. Specific things to ask or verify:
- Provide the correct runtime and usage: either include the Python scripts referenced in SKILL.md or update instructions to call the Node module. The current SKILL.md example (python3 scripts/ze_ri.py) is not present in the bundle.
- Fix the index.js file: it contains non-ASCII punctuation (fullwidth colons '：' and commas '，') and unquoted Chinese property names which make the JS likely syntactically invalid. Request a version that executes (or a transpiled/reasoned explanation if those characters are intentional).
- Confirm versioning: SKILL.md says v2.0.0 while index.js header says v1.1 — ask which is authoritative and request a changelog.
- Ask the author to provide a working example (node or python) and tests so you can verify behavior locally. Until these are resolved treat the package as untrusted; the inconsistencies could be benign packaging errors but also hide attempts to confuse automated reviewers.Like a lobster shell, security has layers — review code before you run it.
chinese-culturevk9772e0cx0dtg6wkrar547t1ys83x7nadivinationvk9772e0cx0dtg6wkrar547t1ys83x7nai-chingvk9772e0cx0dtg6wkrar547t1ys83x7nalatestvk97djy0t8rakhq281m1hnnbcnh845czg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.